The ESP32‑audioI2S 3.4.5 firmware contains a buffer overflow in the MP3Decoder::decode() routine due to missing size validation on the untrusted mainDataBegin and nSlots parameters. This flaw can let an attacker overwrite adjacent memory, potentially leading to arbitrary code execution or crashing the device. The weakness is a classic buffer overflow (CWE‑119) that compromises data integrity and can allow bypass of normal control flow. Without mitigating bounds checks, the overflow may be exploitable in a device that accepts arbitrary MP3 data from an external source.

The vulnerability is limited to the ESP32‑audioI2S library, version 3.4.5 and later releases that contain the same unpatched MP3 decoder logic. This library is used in Internet‑of‑Things and embedded audio projects that run on ESP32 microcontrollers. No other vendors or versions are currently affected according to the data available.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack could be carried out by feeding specially crafted MP3 streams to the affected device. The likely attack vector is local or remote, depending on whether the decoder processes externally sourced data. The absence of boundary checks allows an attacker to overflow the buffer, potentially hijacking control flow.